February 17, 2016 issue of the DPSAC NEWS

In This Issue

Spotlight on...Service Providers

Make ORS Personnel Security Your 1st Stop When Seeking Assistance from Another OPDIV

The REAL ID Act and NIH

AOs & ATs: Watch for Renewal Notices for Temporary 6-Month Badges

News Briefs - DHS Announces Schedule for REAL ID Act Final Implementation Phase

Helpful Tips

FAQs

NED Training Schedule for Remainder of FY '16

Past Issues

Contact Us

Division of Personnel Security and Access Control (DPSAC),

Office of Research Services

Personnel Security

Helpdesk: 301-402-9755

E-mail: orspersonnelsecurity@

mail.nih.gov

Access Control

Helpdesk: 301-451-4766

E-mail: facilityaccesscontrol@

mail.nih.gov

This is the ninth in a series of articles spotlighting position classifications that the NIH uses to determine the type of badge it can issue. Based on the individual's classification, s/he will be eligible for either an HHS ID Badge (also known as a Personal Identity Verification or PIV Card), a Restricted Local Access (RLA) Badge or an NIH Legacy ID Badge.

Determining an individual's correct classification is an important first step in the badge issuance process since it helps ensure that each person requiring access to NIH facilities and resources is vetted appropriately and qualifies for one of the three badge types.*

Classification: Service Provider

(as the classification appears on the 'Badging Authority By Classification Table' posted at: http://www.ors.od.nih.gov/ser/dpsac/badge/Pages/applying.aspx)

Who is a Service Provider?
A Service Provider is an individual who works for a company that provides services in support of the NIH mission.

Service Provider badges are limited to a select few individuals who provide mission support services to the NIH. Due to past abuses in the sponsorship and badge issuance process related to this category of visitor, very strict adherence to an individual's mission support function and continuous need for access are judged by the Chief of Police.

As an example, a sales representative is not considered to provide mission support to the NIH, whereas a nitrogen or oxygen delivery person accessing the campus two or three times a week is.

Other examples of individuals that fall within the Service Provider classification include: UPS and FedEx delivery persons, photocopier repair personnel, etc. These individuals are not directly or indirectly paid by the NIH.

What else should you know about Service Providers?
Service Providers is one of twelve categories of personnel listed on the Extended Visitors application form. Service Providers are given access to NIH facilities to provide a variety of services, ranging from pest control to vending machine operators, medical device representatives/repair persons, etc.

In addition to completing the badge application form, Service Providers must also submit a letter on company letterhead to the NIH Police to validate the individual's need to access NIH facilities.

Upon conducting an internal security review in 2014, the Office of Research Services (ORS) discovered numerous individuals in possession of a Service Provider badge who did not visit NIH frequently enough to warrant possessing an ID badge.

ORS also discovered individuals sharing their Service Provider badge with other people (e.g., multiple pizza delivery employees from one restaurant sharing an ID badge). As a result, the NIH Police have tightened restrictions on who is eligible for a Service Provider badge and must review each application before approving the issuance of an ID badge.

Who is NOT a Service Provider?
Construction Workers and Grounds Maintenance also provide services to the NIH. However, each of these positions is classified separately on the Extended Visitor form and provides services to the NIH specific to that classification.

Construction Workers are defined as individuals who support the NIH's construction efforts and are not employees of the NIH. Grounds maintenance are defined as individuals who provide landscaping, snow removal and other services at NIH facilities and also are not employees.

Service Providers, Construction Workers and Ground Maintenance all undergo a fingerprint check through the NIH Police and are issued an NIH Legacy Badge for identification purposes and for physical access to the NIH campus (see "Type of badge issued to Service Providers" below).

Figure 1.

Type of badge issued to Service Providers
Service Providers are issued an NIH Legacy Badge for
identification purposes and for physical access to the
NIH campus (Figure 1).

Are Service Providers entered into NED?
No. Service Provider applicants must complete an
Extended Visitor application that is reviewed and
sponsored by his or her Institute's or Center's (IC) PIV
approved Administrative Officer (AO).

Who processes the badge requests for Service Providers?
The Service Provider badge applicant must first complete the Extended Visitor application (posted in PDF format at: http://security.nih.gov/Documents/Extended%20Visitor%20Form.pdf) and bring the completed form to his or her IC's Sponsoring AO.

The Extended Visitor application includes the individual's Full Name, complete Home Address, Social Security Number, Date of Birth, Citizenship, Gender and Signature. The application must also include a justification statement to support the request that falls into the Service Provider category.

Once the AO reviews and signs the application as the Sponsor, the applicant will be directed to take the application to the duty officer at the Badging Desk at the Gateway Center (Building 66). There, the applicant will present the completed application to the badging officer along with an official letter on company letterhead confirming that he or she is an employee of that specific company and will need access to the NIH campus. All Service Provider badge applications must then be reviewed and approved by the Chief of the NIH Police.

Once the application is approved, the Service Provider and the Sponsoring AO will be instructed via e-mail to visit the badging officer at the Gateway Center where he or she will take the applicant's fingerprints electronically and submit them to the FBI for a Special Agency Check (SAC).

Once the NIH Police receive the fingerprint (SAC) results (usually within 10 business days of submission to the FBI), they will e-mail the applicant and the Sponsoring AO with the results and instructions to visit the Gateway Center Badging Desk to be photographed and issued an NIH Legacy Badge.

What background investigation is required for Service Providers?

Service Provider applicants are fingerprinted by the NIH Police. The NIH Police forward the fingerprints electronically to the FBI, which conducts a Special Agency Check (SAC) to identify any criminal history.

How long is the badge good for?
NIH Legacy Badges issued to Service Providers have a lifecycle of up to one year. At the end of the badge's lifecycle, the badge holder will be required to renew his or her ID Badge.

Disposition of a Service Provider's ID Badge

When Service Providers end their employment/affiliation with the NIH, they must turn in their ID badge to their AO/Sponsor. The AO/Sponsor must return the badge to DPSAC in Building 31, Room 1B03 or the local ID Badge issuance office.

Should you have questions about a classification, please call the DPSAC Helpdesk at 301-402-9755 or e-mail them at: orspersonnelsecurity@mail.nih.gov

*The 'NIH Badging Authority by Classification Table' containing brief descriptions of all position classifications can be viewed on the DPSAC website at:http://www.ors.od.nih.gov/ser/dpsac/badge/Pages/applying.aspx

Make ORS Personnel Security Your First Stop When Seeking Badging Assistance from Another HHS Operating Division (OPDIV)
(this article first appeared in the February 3, 2016 DPSAC News)

From time to time remote NIH employees, contractors, and affiliates will require assistance with identity proofing, enrollment, certificate renewal, and ID badge issuance. If an individual is unable to visit an NIH badging facility due to lack of proximity, please reach out to the NIH Division of Personnel Security and Access Control (DPSAC) to request scheduling an appointment at a non-NIH Health and Human Services (HHS) badging facility.

Please DO NOT reach out directly to non-NIH HHS badging offices for badging assistance.

AOs should contact ORS Personnel Security regarding remote badging services. There are existing agreements with the Program Support Center (PSC) in the following cities: Boston, New York City, Philadelphia, Atlanta, Chicago, Dallas, Kansas City (Missouri), Denver, San Francisco and Seattle.

There are additional HHS badging facilities at locations not listed here that require DPSAC to communicate with on a case by case basis.

DPSAC will coordinate all of the badging services related to the remote individual. DPSAC encourages Administrative Officers (AOs) to contact ORS Personnel Security at orspersonnelsecurity@mail.nih.gov in order to make the arrangements with the appropriate parties.

Please contact ORS Personnel Security for any other inquires related to NIH badging.

The REAL ID Act and NIH

U.S. Secretary of Homeland Security Jeh Johnson recently announced the schedule for implementing the fourth and final phase of the REAL ID Act.
Starting October 1, 2020, every air traveler will need a REAL ID-compliant license, or another acceptable form of identification, for domestic commercial air travel (see News Briefs below for Secretary Johnson's statement and the schedule for completing this final phase).

Note: Starting January 22, 2018, passengers with a driver's license issued by a state that is still not compliant with the REAL ID Act (and has not been granted an extension) will need to show an alternative form of
acceptable identification for domestic air travel to board their flight. Passengers with driver's licenses issued by a state that is compliant with REAL ID (or a state that has been issued an extension) will still be able to use their driver's licenses or identification cards.

The REAL ID Act prohibits federal agencies from accepting, for official purposes, driver's licenses and identification cards issued by states that do not meet the law's standards for secure issuance and production.

On October 10, 2015, DHS implemented Phase 3 of the Act, which applies the REAL ID Act to all federal facilities "except those providing healthcare, federally protected benefits and participation in law enforcement functions."

Because the NIH falls into the category of 'excepted federal facilities' by providing health care and federally protected benefits, it is not currently enforcing the REAL ID Act for campus access purposes. The current NIH policy is to accept all driver's licenses so that patients, invited speakers, and medical students are not turned away.*

The Office of Security and Emergency Response has asked the NIH Office of General Counsel (OGC) to determine REAL ID enforcement applicability for NIH.

*While American Samoa, Illinois, Missouri, New Mexico, Minnesota and Washington currently do not comply with the act and do not have an extension from DHS, NIH is currently accepting driver's licenses from these states and territory. This may change based on OGC's interpretation of the law.

AOs and ATs: Watch for Renewal Notices for Temporary 6-Month Badges in Your NED Inboxes

AOs and ATs should be on the lookout for renewal notices that may appear in their NED inboxes for individuals with temporary (six-month) badges. These badges were issued after the Office of Personnel Management (OPM) suspended e-QIP access between July 16, 2015 and August 25, 2015 to remedy security problems with the system.

These renewal notices will run their course over the next two months.

Note: the background information request forms processed during this outage were paper. Since OPM did not accept these paper forms, anyone who falls into this category or still has a 6-month badge must complete the background investigation request online via e-QIP.

News Briefs

DHS Announces Schedule for REAL ID Act Final Implementation Phase

Excerpted from the January 15, 2016 statement by Secretary of Homeland Security Jeh Johnson on the final phase of REAL ID Act Implementation

Today, I announce the schedule for the final phase of implementation of the REAL ID Act. Bottom line up front: Effective January 22, 2018, air travelers with a driver's license or identification card issued by a state that does not meet the requirements of the REAL ID Act (unless that state has been granted an extension to comply with the Act) must present an alternative form of identification acceptable to the Transportation Security Administration (TSA) in order to board a commercial domestic flight.

Over the next two years, those states that are not REAL ID compliant are strongly encouraged to meet the requirements of the law for the benefit of their residents.

In 2004, the 9/11 Commission recommended that the U.S. government set standards for the issuance of "sources of identification, such as driver's licenses." The Commission recognized that "[s]ources of identification are the last opportunity to ensure that people are who they say they are and to check whether they are terrorists."

In accordance with that recommendation, Congress enacted the REAL ID Act. This law prohibits federal agencies from accepting, for official purposes, driver's licenses and identification cards issued by states that do not meet the law's standards for secure issuance and production. The law charges the Department of Homeland Security with establishing minimum requirements for these standards.

So, for a license or identification card to be REAL ID compliant, the state issuing it must, for example, incorporate anti-counterfeit technology into the card, verify the applicant's identity, and conduct background checks for employees involved in issuing driver's licenses.

The overall goal of the REAL ID Act passed by Congress is to prevent the fraudulent issuance and use of driver's licenses and identification cards, thereby ensuring the safety and security of the American public.

Since its enactment, the Department of Homeland Security has implemented the law in careful phases, including most recently at military bases, most federal facilities, and nuclear power plants. Now it is time to move toward final implementation of the law.

At present, 23 states are fully compliant with the REAL ID Act, and the Department has used its authority to grant states extensions when they demonstrate steps toward compliance. Thus, 27 states and territories have been granted extensions for a period of time to become compliant. Six states and territories - Illinois, Minnesota, Missouri, New Mexico, Washington, and American Samoa - are non-compliant and do not currently have extensions.

We have now reached the final phase of implementation of the REAL ID Act, which relates to commercial air travel. To read the Secretary's entire statement, including the timelines for that final phase, click here.

Important: Right now, no individual needs to adjust travel plans, or rush out to get a new driver's license or a passport for domestic air travel.

Until January 22, 2018, residents of all states will still be able to use a state-issued driver's license or identification card for domestic air travel.

Helpful Tips

Do not lend your ID badge to anyone!-- lending out your ID badge is prohibited. The issuance of ID badges is based on strict identity proofing and the determination of one's suitability for a specific position classification.

AOs who wish to obtain sponsor authority -- must complete the sponsor training (see:http://www.ors.od.nih.gov/ser/dpsac/
Training/Pages/administrators.aspx) and e-mail a copy of your signed certificate to the NIH HSPD-12 Program Office at: hspd12@od.nih.gov. Upon receipt of the certificate, the Program Office will authorize the AO as a sponsor.

ICs that want to add Lifecycle Work Station (LWS) operators to the approved roster -- send a written request to Richie Taffet at: taffetr@mail.nih.gov. Your request should include:

the new operator's name
his/her IC
his/her NED number
the operator's e-mail address, building/room and phone number

Once Mr. Taffet has approved the request, he will forward the name(s) to HHSIdentityAdmins@deloitte.com to complete the approval process, add the name(s) to the LWS operator roster, and inform the IC that the individual is now approved to operate the LWS.

Need to make changes to the LWS operator directories? -- drop an e-mail to Lanny Newman, newmanl@mail.nih.gov, and let him know what needs changing (e.g., adding new operators or LWS locations, removing operators, etc.). Remember, before a new operator can be added to the LWS directory, s/he must first be approved by Richie Taffet (see preceding Helpful Tip).

If an LWS is not available in your IC or your immediate area, and you work in the greater Bethesda or Rockville area -- please call 301-402-9755 to schedule an appointment with the Division of Personnel Security and Access Control located in Building 31, Room B1A26 or in Building 10, South Lobby, Room 1C52.

If you work outside the Bethesda/Rockville area, contact your local badge issuance office. You can find contact information for all badge issuance offices at: http://www.ors.od.nih.gov/ser/dpsac/Pages/contactinfo.aspx

Know someone who could benefit by receiving DPSAC News? -- have the person contact Lanny Newman at newmanl@mail.nih.gov and ask to be put on the mailing list.

FAQs

Q. Will I need to renew my PIV Card (Digital) Certificates at the same time I renew my expiring PIV Card?

A. Certificate lifecycles can vary and do not necessarily coincide with PIV Card lifecycles (i.e., PIV Card expiration dates).

Certificate renewals: The HHS Smart Card Management System (SCMS) sends alerts to the PIV Card holder when his or her certificates are within 42 days of expiration, and every 7 days until they expire or until they are renewed. PIV Card holders should make sure that their e-mail settings enable receipt of these alerts:

Sender: HHSIdentity [donotreply@hhs.gov].
Subject: ACTION REQUIRED: The certificates on your HHS ID badge must be renewed.

To renew digital certificates, it is recommended that the PIV Card holder use the ACU (Access Card Utility) as it is the easiest and most convenient method and can be run from any Windows computer. For detailed information on how to use the ACU on an IC-by-IC basis visit: https://ocio.nih.gov/Smartcard/Pages/ACUinfo.aspx

Additional information about renewing digital certificates can be found on the OCIO digital certificate website:https://ocio.nih.gov/Smartcard/Pages/certificate-renewal.aspx

PIV Card renewals: NED generates the badge renewal task exactly 42 days prior to the expiration date. Any AT or AO with SAC coverage for the individual can view and run the renewal task. (The AO/AT can request a badge renewal in NED using "Manage Services Renew Badge" up to 180 days prior to but no more than 42 days of the badge expiration date).

Once the renewal task is run in NED, the badge holder will start receiving e-mails about next steps. This applies to both PIV and RLA badges.

NED Training Schedule: a Class a Month for the Balance of FY '16

New and relatively inexperienced NED Portal users with an Administrative Officer (AO) or Administrative Technician (AT) role are invited to take advantage of one of the hands-on NED training classes being offered (once a month) through the end of fiscal year 2016.

Each class will provide an overview of the NED Portal and the NIH business functions it supports from the perspective of a NED Portal user with the AO or AT role.

Upon completing the course, students will have a solid working knowledge of the NED Portal and be able to perform the following tasks: Register/Activate, Update, Modify, Transfer, Badge Renewal and Deactivate.

The course will also familiarize students with other aspects of the NED Portal so they can set their primary SAC coverage using Preferences, determine the status of a person's ID badge and/or network account request, look up and view information in a person's NED record and utilize NED reporting capabilities.

To register for one of the classes listed below, go to: http://training.cit.nih.gov/class_details.aspx?cId=NIHCIT-GN142

A biweekly e-newsletter from the Office of Research Services, Division of Personnel Security and Access Control (ORS/DPSAC) to keep you informed as NIH rolls out "Homeland Security Presidential Directive 12" (HSPD-12) establishing a common identification standard to better safeguard NIH and its workforce.